NAME

     farpd — ARP reply daemon

SYNOPSIS

     farpd [-d] [-i interface] [net ...]

DESCRIPTION

     farpd replies to any ARP request for an IP address matching the specified destination net
     with the hardware MAC address of the specified interface, but only after determining if
     another host already claims it.

     Any IP address claimed by farpd is eventually forgotten after a period of inactivity or
     after a hard timeout, and is relinquished if the real owner shows up.

     This enables a single host to claim all unassigned addresses on a LAN for network monitoring
     or simulation.

     farpd exits on an interrupt or termination signal.

     Note: The program name farpd has been changed in Debian GNU/Linux from the original name
     (arpd) to avoid name clash with other ARP daemons.

     The options are as follows:

     -d      Do not daemonize, and enable verbose debugging messages.

     -i interface
             Listen on interface.  If unspecified, farpd searches the system interface list for
             the lowest numbered, configured ``up'' interface (excluding loopback).

     net     The IP address or network (specified in CIDR notation) or IP address ranges to claim
             (e.g. ``10.0.0.3'', ``10.0.0.0/16'' or ``10.0.0.5-10.0.0.15''). If unspecified,
             farpd will attempt to claim any IP address it sees an ARP request for.  Mutiple
             addresses may be specified.

FILES

     /var/run/farpd.pid

SEE ALSO

     pcapd(8), synackd(8)

BUGS

     farpd will respond too slowly to ARP requests for some applications. In order to ensure that
     it does not claim existing IP addresses it will send two ARP request and wait for a reply.
     This slowness affects the nmap network scanning tool, and possibly others, which uses by
     default ARP when scanning local networks. The answers from farpd will come after the tool
     has timeout waiting for the ARP replies and, consequently, IP addresses claimed by farpd
     will not be discovered.

     Additionally, farpd sends the ARP replies to the broadcast address of the network and not to
     the host that send the ARP request. Some systems and applications (notably nmap) will not
     handled these requests and expect directed ARP replies (i.e. targeted specifically to the
     host that sent the request and not to the network)

AUTHORS

     Dug Song ⟨dugsong@monkey.org⟩, Niels Provos ⟨provos@citi.umich.edu⟩

                                          August 4, 2001